Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in FreshRSS, a self-hosted RSS aggregator, that could allow an unprivileged attacker to create a new administrator user if registration is enabled. This could potentially lead to unauthorized control over the application. The main concern is confirming relevance and exposure of this type of self-hosted application within the organization.
- Unprivileged users can gain admin access.
- Critical access granted without proper controls.
- Confirm if self-hosted RSS feeds are in use.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can gain administrative access to a FreshRSS instance by exploiting a flaw in the user registration process. If registration is enabled, the attacker can create a new administrator account by manipulating a hidden field during user creation, leading to full control of the instance.
- Registration must be enabled.
- Create an admin user via a hidden field.
- Complete takeover of the instance.
Live Threat
Current exploitation, exposure, and threat context
An unprivileged attacker could create a new administrator user on a FreshRSS instance when registration is enabled. This could allow them to gain administrative control over the application.
- Affected asset: FreshRSS administrator account.
- Exposure: Exploiting a hidden field during user registration.
- Consequence: Unauthorized administrative control.
Operational Fix
Recommended remediation, mitigation, and detection steps
The FreshRSS application owner or the platform team responsible for its deployment should lead the remediation efforts. The first step is to inventory all FreshRSS instances, confirm if the registration feature is enabled, and assess business criticality and internet reachability. Once ownership and exposure are confirmed, a risk-based remediation plan, potentially involving vendor coordination or temporary risk reduction, can be developed.
- Identify FreshRSS instance owners.
- Verify registration feature and exposure.
- Plan remediation based on risk.
